Skip to main content

How to Encrypt an EBS Volume

Keeping data and applications safe in the cloud is one the most visible challenges facing cloud teams in 2018. Cloud storage services where data resides are frequently a target for hackers, not because the services are inherently weak, but because they are often improperly configured.

Encryption—to protect data at rest and in-flight—should be an organization’s number-one priority when using any storage service. On AWS, its Elastic Block Store (EBS) service provides persistent block-level storage volumes for Amazon EC2 instances. EBS volumes can be attached to your instances and primarily used for data that is rapidly changing or that requires specific input/output operations per second, (IOPS). Because they provide persistent level storage to your instances, EBS volumes are ideally suited for retaining important data and can be used to store personally identifiable information (PII). In any environment where this is the case, it’s essential that data on the volume is encrypted to protect it from malicious activity.

AWS makes encryption easy. In this post, we’ll step through three processes using AWS Elastic Block Store to help you make sure that your encryption is configured correctly.

How to Encrypt an EBS Volume

With the EBS encryption mechanism, you don’t have to worry about managing keys to perform encryption yourself—it’s all managed and implemented by EBS. However, there are a couple of different ways that encryption can be applied depending on how and when you are creating your new EBS volumes. I will walk you through each process.

Encryption for a new EBS Volume

  1. From within the AWS Management Console, select EC2
  2. Under ‘Elastic Block Store’ select ‘Volumes’
  3. Select ‘Create Volume’
  4. Enter the required configuration for your Volume
  5. Select the checkbox for ‘Encrypt this volume’
  6. Select the KMS Customer Master Key (CMK) to be used under ‘Master Key’
  7. Select ‘Create Volume’

Encryption EBS Create Volume
Once your volume has been created, all data saved to this volume will be encrypted when attached to an EC2 instance.

Encrypt a new EBS volume when launching an EC2 instance

    1. From within the AWS Management Console, select EC2
    2. Select ‘Launch Instance’
    3. Select your AMI type
    4. Select your Instance Type
    5. Click ‘Next: Configure Instance Details’
    6. Configure your instance as required
    7. Select ‘Next: Add Storage’
    8. Select ‘Add New Volume’
    9. Ensure your volume type is ‘EBS’ and configure your storage requirements
    10. Select the drop-down list under ‘Encryption’ and select the KMS CMK key to be used
    11. Continue with your EC2 instance launch process

Volume Type Encryption
The EBS volume attached to that instance will now be encrypted. It’s also worth noting that any snapshots created from these encrypted volumes (and any volumes created from these snapshots) will also be encrypted.

EBS with KMS

The EBS service interacts with another AWS service, the Key Management Service (KMS) to perform encryption. KMS uses Customer Master Keys (CMK) to create Data Encryption Keys (DEK), which enables data encryption across EBS and a range of AWS services.

When a volume is defined as an encrypted volume, EBS sends a request to KMS asking for a Data Encryption Key. The DEK is generated AND encrypted by the Customer Master Key, which by default will be a unique, regional CMK provided by AWS unless otherwise specified. The encrypted DEK is then stored with the metadata on the EBS volume.

It’s important to point out that no data has been encrypted up to this point. So far only the Data Encryption Key has been encrypted. The data encryption process is driven from the EC2 instance, not the EBS volume, so your data will be encrypted when it is connected to an associated EC2 instance.

When the volume is attached to an EC2 instance, the instance sends a ‘decrypt’ request to KMS along with the encrypted DEK from the EBS volume. KMS then responds with a plaintext version of the DEK. EC2 will store this within its hypervisor memory, allowing the instance itself to perform encryption on any read/writes to the EBS volume using the plaintext version of the DEK.

The DEK uses the AES-256 (Advanced Encryption Standard – 256 bit) algorithm to encrypt any data written. The process is managed from the EC2 instance, which ensures that the data is also encrypted when in transit to the EBS volume.

Let’s look at the full process:

  1. A volume is defined as ‘encrypted’ in EBS
  2. EBS calls KMS to request a Data Encryption Key
  3. KMS generates a DEK from the specified Customer Master Key
  4. The CMK encrypts the DEK
  5. The DEK is then stored on the encrypted EBS volume as metadata
  6. The EBS volume is then attached to an EC2 instance
  7. EC2 sends a ‘decrypt’ request to KMS with the encrypted DEK from the volume
  8. KMS decrypts the DEK into a plaintext DEK and sends it back to the EC2 instance
  9. EC2 stores the plaintext DEK in its hypervisor memory for as long as the EBS volume is attached to the instance
  10. EC2 uses the DEK to perform I/O encryption to the volume using the AES-256 algorithm

How to Encrypt an Existing EBS Volume

An existing unencrypted volume and the data it contains may not be encrypted. Instead, you’ll need to follow another process, outlined below.
1. Select your unencrypted volume
2. Select ‘Actions’ – ‘Create Snapshot’
3. When the snapshot is complete, select ‘Snapshots’ under ‘Elastic Block Store’ Select your newly created snapshot
4. Select ‘Actions’ – ‘Copy’
5. Check the box for ‘Encryption’
6. Select the CMK for KMS to use as required
7. Click ‘Copy’
Snapshot Encryption Master Key
8. Select the newly created snapshot
9. Select ‘Actions’ – ‘Create Volume’
10. You will notice that the normal ‘Encryption’ option is set to ‘True.’ Because the snapshot is itself encrypted, this cannot be modified. The volume now created from this snapshot will be encrypted
Encryption EBS Create Volume True

Supported Instance Types for Encryption

Although all EBS volume types support encryption, not all instance types are supported.

The following AWS instance types are supported for EBS encryption:
Encryption EBS Instance Family
Image Source: Encryption Supported Instances

Consult the official AWS documentation to stay up to date with the supported instance types.

Now that you understand how your sensitive data can be protected through EBS encryption, you’ll want to learn more about encryption for other AWS services such as Encryption in S3, KMS, Redshift, and CloudHSM.

Get started with these courses from the Cloud Academy Training Library:
AWS Big Data Security: Encryption
Amazon Web Services – Key Management Service (KMS)
Getting started with AWS CloudHSM

Written by

Stuart Scott

Stuart is the AWS content lead at Cloud Academy where he has created over 40 courses reaching tens of thousands of students. His content focuses heavily on cloud security and compliance, specifically on how to implement and configure AWS services to protect, monitor and secure customer data and their AWS environment.

Related Posts

Sanket Dangi
— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
Andrew Larkin
— January 24, 2019

The 9 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS certifications
Andrew Larkin
— November 28, 2018

Two New EC2 Instance Types Announced at AWS re:Invent 2018 – Monday Night Live

The announcements at re:Invent just keep on coming! Let’s look at what benefits these two new EC2 instance types offer and how these two new instances could be of benefit to you. If you're not too familiar with Amazon EC2, you might want to familiarize yourself by creating your first Am...

Read more
  • AWS
  • EC2
  • re:Invent 2018
Guy Hummel
— November 21, 2018

Google Cloud Certification: Preparation and Prerequisites

Google Cloud Platform (GCP) has evolved from being a niche player to a serious competitor to Amazon Web Services and Microsoft Azure. In 2018, research firm Gartner placed Google in the Leaders quadrant in its Magic Quadrant for Cloud Infrastructure as a Service for the first time. In t...

Read more
  • AWS
  • Azure
  • Google Cloud
Khash Nakhostin
Khash Nakhostin
— November 13, 2018

Understanding AWS VPC Egress Filtering Methods

In order to understand AWS VPC egress filtering methods, you first need to understand that security on AWS is governed by a shared responsibility model where both vendor and subscriber have various operational responsibilities. AWS assumes responsibility for the underlying infrastructur...

Read more
  • Aviatrix
  • AWS
  • VPC
Jeremy Cook
— November 10, 2018

S3 FTP: Build a Reliable and Inexpensive FTP Server Using Amazon’s S3

Is it possible to create an S3 FTP file backup/transfer solution, minimizing associated file storage and capacity planning administration headache?FTP (File Transfer Protocol) is a fast and convenient way to transfer large files over the Internet. You might, at some point, have conf...

Read more
  • Amazon S3
  • AWS
Guy Hummel
— October 18, 2018

Microservices Architecture: Advantages and Drawbacks

Microservices are a way of breaking large software projects into loosely coupled modules, which communicate with each other through simple Application Programming Interfaces (APIs).Microservices have become increasingly popular over the past few years. The modular architectural style,...

Read more
  • AWS
  • Microservices
Stuart Scott
— October 2, 2018

What Are Best Practices for Tagging AWS Resources?

There are many use cases for tags, but what are the best practices for tagging AWS resources? In order for your organization to effectively manage resources (and your monthly AWS bill), you need to implement and adopt a thoughtful tagging strategy that makes sense for your business. The...

Read more
  • AWS
  • cost optimization
Stuart Scott
— September 26, 2018

How to Optimize Amazon S3 Performance

Amazon S3 is the most common storage options for many organizations, being object storage it is used for a wide variety of data types, from the smallest objects to huge datasets. All in all, Amazon S3 is a great service to store a wide scope of data types in a highly available and resil...

Read more
  • Amazon S3
  • AWS
Cloud Academy Team
— September 18, 2018

How to Optimize Cloud Costs with Spot Instances: New on Cloud Academy

One of the main promises of cloud computing is access to nearly endless capacity. However, it doesn’t come cheap. With the introduction of Spot Instances for Amazon Web Services’ Elastic Compute Cloud (AWS EC2) in 2009, spot instances have been a way for major cloud providers to sell sp...

Read more
  • AWS
  • Azure
  • Google Cloud
  • SpotInst
Guy Hummel and Jeremy Cook
— August 23, 2018

What are the Benefits of Machine Learning in the Cloud?

A Comparison of Machine Learning Services on AWS, Azure, and Google CloudArtificial intelligence and machine learning are steadily making their way into enterprise applications in areas such as customer support, fraud detection, and business intelligence. There is every reason to beli...

Read more
  • AWS
  • Azure
  • Google Cloud
  • Machine Learning
Stuart Scott
— August 17, 2018

How to Use AWS CLI

The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services.So you’ve been using AWS for awhile and finally feel comfortable clicking your way through all the services....

Read more
  • AWS